Skip to main content

Commands

For bootstrap, run and update commands you must either provide a config file or a prefix value. This is required for creating and finding cloud resources. Bootstrap adds that value as an environment variable for the agent pipeline.

The cloud provider is selected by the credentials/flags supplied: AWS by default, Google Cloud when --project-id is set, Oracle Cloud when --oci-compartment-id is set and Azure when --azure-subscription-id is set. Oracle also requires --oci-region and Azure --azure-location.

bootstrap​

Creates the required cloud resources and pipelines for executing the agent run and update commands. If the pipeline already exists, the agent image version will be updated if needed and a new execution of the run command will be started. For AWS, CodePipeline is used; for GCloud, Cloud Run Jobs; for Oracle, DevOps build pipelines (one plan/apply pipeline per step) with a DevOps deployment pipeline for manual approval.

OPTIONS:

  • logging - logging level (debug | info | warn | error) (default: info) [$LOGGING]
  • config - config file path and name, only needed for first run or when overriding an existing config [$CONFIG]
  • prefix - prefix used when creating cloud resources (default: config prefix) [$PREFIX]
  • project-id - project id used when creating gcloud resources [$PROJECT_ID]
  • location - location used when creating gcloud resources [$LOCATION]
  • zone - zone used in gcloud run jobs [$ZONE]
  • google-application-credentials-json - optional, gcloud service account credentials JSON string [$GOOGLE_APPLICATION_CREDENTIALS_JSON]
  • oci-region - oracle cloud region used when creating oracle resources [$OCI_REGION]
  • oci-compartment-id - oracle cloud compartment ocid where resources are created, selects the oracle provider when set [$OCI_COMPARTMENT_ID]
  • oci-profile - oracle cloud config file profile used for credentials, empty uses the default profile [$OCI_PROFILE]
  • oci-config-file - path to the oracle cloud config file used for credentials, empty uses ~/.oci/config [$OCI_CONFIG_FILE]
  • azure-subscription-id - azure subscription id where resources are created, selects the azure provider when set [$AZURE_SUBSCRIPTION_ID]
  • azure-location - azure location used when creating resources, required with azure-subscription-id [$AZURE_LOCATION]
  • azure-resource-group - existing azure resource group for the agent resources, defaults to <prefix>-<location> which the agent creates and deletes when empty; a provided group must not be shared by the same prefix in another location [$AZURE_RESOURCE_GROUP]
  • role-arn - role arn for assume role, used when creating aws resources in external account [$ROLE_ARN]
  • start - start pipeline execution after creating (default: true) [$START]

Example

bin/ei-agent bootstrap --config=config.yaml --prefix=infralib

run​

Processes config steps, creates and executes CodePipelines which apply Entigo Infralib OpenTofu modules. Run command only executes a single cycle of the pipeline. Can be used to apply config changes.

OPTIONS:

  • logging - logging level (debug | info | warn | error) (default: info) [$LOGGING]
  • skip-bucket-creation-delay - skip bucket creation delay (default: false) [$SKIP_BUCKET_CREATION_DELAY]
  • config - config file path and name, only needed for first run or when overriding an existing config [$CONFIG]
  • prefix - prefix used when creating cloud resources (default: config prefix) [$PREFIX]
  • project-id - project id used when creating gcloud resources [$PROJECT_ID]
  • location - location used when creating gcloud resources [$LOCATION]
  • zone - zone used in gcloud run jobs [$ZONE]
  • google-application-credentials-json - optional, gcloud service account credentials JSON string [$GOOGLE_APPLICATION_CREDENTIALS_JSON]
  • oci-region - oracle cloud region used when creating oracle resources [$OCI_REGION]
  • oci-compartment-id - oracle cloud compartment ocid where resources are created, selects the oracle provider when set [$OCI_COMPARTMENT_ID]
  • oci-profile - oracle cloud config file profile used for credentials, empty uses the default profile [$OCI_PROFILE]
  • oci-config-file - path to the oracle cloud config file used for credentials, empty uses ~/.oci/config [$OCI_CONFIG_FILE]
  • azure-subscription-id - azure subscription id where resources are created, selects the azure provider when set [$AZURE_SUBSCRIPTION_ID]
  • azure-location - azure location used when creating resources, required with azure-subscription-id [$AZURE_LOCATION]
  • azure-resource-group - existing azure resource group for the agent resources, defaults to <prefix>-<location> which the agent creates and deletes when empty; a provided group must not be shared by the same prefix in another location [$AZURE_RESOURCE_GROUP]
  • role-arn - optional role arn for assume role, used when creating aws resources in external account [$ROLE_ARN]
  • steps - optional comma separated list of steps to run [$STEPS]
  • allow-parallel - allow running steps in parallel on first execution cycle (default: true) [$ALLOW_PARALLEL]
  • pipeline-type - pipeline execution type (local | cloud), local is meant to be run inside the infralib image (default: cloud) [$PIPELINE_TYPE]
  • print-logs - print OpenTofu/helm logs to stdout when using local execution (default: true) [$PRINT_LOGS]
  • logs-path - optional path for storing OpenTofu/helm logs when running local pipelines [$LOGS_PATH]
  • terraform-cache - use OpenTofu caching (default: true, when using pipeline-type local, default is false) [$TERRAFORM_CACHE]

Example

bin/ei-agent run --config=config.yaml --prefix=infralib

update​

Processes config steps, creates and executes CodePipelines which apply Entigo Infralib OpenTofu modules. Update command updates all modules to the latest or specified versions. Returns if there are no updates available.

OPTIONS:

  • logging - logging level (debug | info | warn | error) (default: info) [$LOGGING]
  • skip-bucket-creation-delay - skip bucket creation delay (default: false) [$SKIP_BUCKET_CREATION_DELAY]
  • config - config file path and name, only needed for first run or when overriding an existing config [$CONFIG]
  • prefix - prefix used when creating cloud resources (default: config prefix) [$PREFIX]
  • project-id - project id used when creating gcloud resources [$PROJECT_ID]
  • location - location used when creating gcloud resources [$LOCATION]
  • zone - zone used in gcloud run jobs [$ZONE]
  • google-application-credentials-json - optional, gcloud service account credentials JSON string [$GOOGLE_APPLICATION_CREDENTIALS_JSON]
  • oci-region - oracle cloud region used when creating oracle resources [$OCI_REGION]
  • oci-compartment-id - oracle cloud compartment ocid where resources are created, selects the oracle provider when set [$OCI_COMPARTMENT_ID]
  • oci-profile - oracle cloud config file profile used for credentials, empty uses the default profile [$OCI_PROFILE]
  • oci-config-file - path to the oracle cloud config file used for credentials, empty uses ~/.oci/config [$OCI_CONFIG_FILE]
  • azure-subscription-id - azure subscription id where resources are created, selects the azure provider when set [$AZURE_SUBSCRIPTION_ID]
  • azure-location - azure location used when creating resources, required with azure-subscription-id [$AZURE_LOCATION]
  • azure-resource-group - existing azure resource group for the agent resources, defaults to <prefix>-<location> which the agent creates and deletes when empty; a provided group must not be shared by the same prefix in another location [$AZURE_RESOURCE_GROUP]
  • role-arn - optional role arn for assume role, used when creating aws resources in external account [$ROLE_ARN]
  • steps - optional comma separated list of steps to run [$STEPS]
  • pipeline-type - pipeline execution type (local | cloud), local is meant to be run inside the infralib image (default: cloud) [$PIPELINE_TYPE]
  • print-logs - print OpenTofu/helm logs to stdout when using local execution (default: true) [$PRINT_LOGS]
  • logs-path - optional path for storing OpenTofu/helm logs when running local pipelines [$LOGS_PATH]
  • terraform-cache - use OpenTofu caching (default: true, when using pipeline-type local, default is false) [$TERRAFORM_CACHE]

Example

bin/ei-agent update --config=config.yaml --prefix=infralib

destroy​

Executes the destroy pipelines in reverse config order. Warning! This will remove the resources provisioned by the step pipelines. Agent automatically approves the changes.

OPTIONS:

  • logging - logging level (debug | info | warn | error) (default: info) [$LOGGING]
  • config - config file path and name, only needed when overriding an existing config [$CONFIG]
  • prefix - prefix used when creating cloud resources (default: config prefix) [$PREFIX]
  • project-id - project id used when creating gcloud resources [$PROJECT_ID]
  • location - location used when creating gcloud resources [$LOCATION]
  • zone - zone used in gcloud run jobs [$ZONE]
  • google-application-credentials-json - optional, gcloud service account credentials JSON string [$GOOGLE_APPLICATION_CREDENTIALS_JSON]
  • oci-region - oracle cloud region used when creating oracle resources [$OCI_REGION]
  • oci-compartment-id - oracle cloud compartment ocid where resources are created, selects the oracle provider when set [$OCI_COMPARTMENT_ID]
  • oci-profile - oracle cloud config file profile used for credentials, empty uses the default profile [$OCI_PROFILE]
  • oci-config-file - path to the oracle cloud config file used for credentials, empty uses ~/.oci/config [$OCI_CONFIG_FILE]
  • azure-subscription-id - azure subscription id where resources are created, selects the azure provider when set [$AZURE_SUBSCRIPTION_ID]
  • azure-location - azure location used when creating resources, required with azure-subscription-id [$AZURE_LOCATION]
  • azure-resource-group - existing azure resource group for the agent resources, defaults to <prefix>-<location> which the agent creates and deletes when empty; a provided group must not be shared by the same prefix in another location [$AZURE_RESOURCE_GROUP]
  • role-arn - role arn for assume role, used when creating aws resources in external account [$ROLE_ARN]
  • yes - skip confirmation prompt (default: false) [$YES]
  • steps - optional comma separated list of steps to destroy [$STEPS]
  • pipeline-type - pipeline execution type (local | cloud), local is meant to be run inside the infralib image (default: cloud) [$PIPELINE_TYPE]
  • print-logs - print OpenTofu/helm logs to stdout when using local execution (default: true) [$PRINT_LOGS]
  • logs-path - optional path for storing OpenTofu/helm logs when running local pipelines [$LOGS_PATH]

Example

bin/ei-agent destroy --config=config.yaml --prefix=infralib

delete​

Processes config steps, removes resources used by the agent, including buckets, pipelines, and roles/service accounts. Warning! Execute destroy pipelines in reverse config order before running this command. This command will remove all pipelines and resources created by OpenTofu will otherwise remain.

OPTIONS:

  • logging - logging level (debug | info | warn | error) (default: info) [$LOGGING]
  • config - config file path and name, only needed when overriding an existing config [$CONFIG]
  • prefix - prefix used when creating cloud resources (default: config prefix) [$PREFIX]
  • project-id - project id used when creating gcloud resources [$PROJECT_ID]
  • location - location used when creating gcloud resources [$LOCATION]
  • zone - zone used in gcloud run jobs [$ZONE]
  • google-application-credentials-json - optional, gcloud service account credentials JSON string [$GOOGLE_APPLICATION_CREDENTIALS_JSON]
  • oci-region - oracle cloud region used when creating oracle resources [$OCI_REGION]
  • oci-compartment-id - oracle cloud compartment ocid where resources are created, selects the oracle provider when set [$OCI_COMPARTMENT_ID]
  • oci-profile - oracle cloud config file profile used for credentials, empty uses the default profile [$OCI_PROFILE]
  • oci-config-file - path to the oracle cloud config file used for credentials, empty uses ~/.oci/config [$OCI_CONFIG_FILE]
  • azure-subscription-id - azure subscription id where resources are created, selects the azure provider when set [$AZURE_SUBSCRIPTION_ID]
  • azure-location - azure location used when creating resources, required with azure-subscription-id [$AZURE_LOCATION]
  • azure-resource-group - existing azure resource group for the agent resources, defaults to <prefix>-<location> which the agent creates and deletes when empty; a provided group must not be shared by the same prefix in another location [$AZURE_RESOURCE_GROUP]
  • role-arn - role arn for assume role, used when creating aws resources in external account [$ROLE_ARN]
  • yes - skip confirmation prompt (default: false) [$YES]
  • delete-bucket - delete the bucket used by OpenTofu state (default: false) [$DELETE_BUCKET]. For Oracle, the agent-owned KMS vault and key that encrypt the bucket are scheduled for deletion (revertible in the console for ~7 days) only when the bucket is deleted.
  • delete-service-account - delete the service account created by service-account command (default: false) [$DELETE_SERVICE_ACCOUNT]

Example

bin/ei-agent delete --config=config.yaml --prefix=infralib

service-account​

Creates a service account and a key for the account. Key will be outputted to the stdout. This account can be used for running the agent in a CI/CD pipeline.

On Oracle Cloud the account is a user in a group whose compartment-scoped policy grants only what a steady-state run needs — no policy management and no KMS/bucket creation, so it runs an already-bootstrapped deployment but cannot bootstrap one or widen its own access. The command itself needs a tenancy administrator, since OCI creates users and groups only in the tenancy root.

Optionally, prefix will be used to pull the config and config is used to check for an encryption module. If present, the created key will be encrypted with customer encryption. More info in Encryption.

OPTIONS:

  • config - config file path and name, only needed when overriding an existing config [$CONFIG]
  • prefix - prefix used when creating cloud resources [$PREFIX]
  • project-id - project id used when creating gcloud resources [$PROJECT_ID]
  • location - location used when creating gcloud resources [$LOCATION]
  • zone - zone used in gcloud run jobs [$ZONE]
  • google-application-credentials-json - optional, gcloud service account credentials JSON string [$GOOGLE_APPLICATION_CREDENTIALS_JSON]
  • oci-region - oracle cloud region used when creating oracle resources [$OCI_REGION]
  • oci-compartment-id - oracle cloud compartment ocid where resources are created, selects the oracle provider when set [$OCI_COMPARTMENT_ID]
  • oci-profile - oracle cloud config file profile used for credentials, empty uses the default profile [$OCI_PROFILE]
  • oci-config-file - path to the oracle cloud config file used for credentials, empty uses ~/.oci/config [$OCI_CONFIG_FILE]
  • azure-subscription-id - azure subscription id where resources are created, selects the azure provider when set [$AZURE_SUBSCRIPTION_ID]
  • azure-location - azure location used when creating resources, required with azure-subscription-id [$AZURE_LOCATION]
  • azure-resource-group - existing azure resource group for the agent resources, defaults to <prefix>-<location> which the agent creates and deletes when empty; a provided group must not be shared by the same prefix in another location [$AZURE_RESOURCE_GROUP]
  • role-arn - role arn for assume role, used when creating aws resources in external account [$ROLE_ARN]
  • rotate-credentials - optional, generate new credentials for an existing service account, default false. Warning! This will delete any previous keys. [$ROTATE_CREDENTIALS]
  • trust-role - optional, instead of generating keys adds a trust relationship in AWS role or allows impersonation of the service account in GCloud. Value needs to be arn for AWS and full principal for GCloud, e.g. serviceAccount:email or user:email. Not supported on Oracle Cloud (no impersonation), where the command always outputs an API signing key and a ready-to-paste ~/.oci/config profile. [$TRUST_ROLE]
  • remove-user - optional, used with trust-role, removes an existing service account user in AWS or credentials in GCloud, default false. [$REMOVE_USER]

Example

bin/ei-agent service-account --prefix=infralib

pull​

Pulls agent config yaml and the config folders from the S3, Cloud Storage, or Oracle Object Storage bucket. Use the force flag to overwrite existing local files.

OPTIONS:

  • logging - logging level (debug | info | warn | error) (default: info) [$LOGGING]
  • config - config file path and name, only needed when overriding an existing config [$CONFIG]
  • prefix - prefix used when creating cloud resources [$PREFIX]
  • project-id - project id used when creating gcloud resources [$PROJECT_ID]
  • location - location used when creating gcloud resources [$LOCATION]
  • zone - zone used in gcloud run jobs [$ZONE]
  • google-application-credentials-json - optional, gcloud service account credentials JSON string [$GOOGLE_APPLICATION_CREDENTIALS_JSON]
  • oci-region - oracle cloud region used when creating oracle resources [$OCI_REGION]
  • oci-compartment-id - oracle cloud compartment ocid where resources are created, selects the oracle provider when set [$OCI_COMPARTMENT_ID]
  • oci-profile - oracle cloud config file profile used for credentials, empty uses the default profile [$OCI_PROFILE]
  • oci-config-file - path to the oracle cloud config file used for credentials, empty uses ~/.oci/config [$OCI_CONFIG_FILE]
  • azure-subscription-id - azure subscription id where resources are created, selects the azure provider when set [$AZURE_SUBSCRIPTION_ID]
  • azure-location - azure location used when creating resources, required with azure-subscription-id [$AZURE_LOCATION]
  • azure-resource-group - existing azure resource group for the agent resources, defaults to <prefix>-<location> which the agent creates and deletes when empty; a provided group must not be shared by the same prefix in another location [$AZURE_RESOURCE_GROUP]
  • force - overwrite existing local files, default false. Warning! Force deletes the /config subfolder before writing. [$FORCE]

Example

bin/ei-agent pull --prefix=infralib

provision​

Used by Infralib wrapper layer. provision is executed by a step pipeline. It wraps the Infralib output and, when a wrapper block is configured in the agent config, forwards raw stdout log lines and a compact plan summary to the backend over gRPC. Without a wrapper config the invocation is fully transparent. Infralib output goes only to the pipeline's normal stdout. All the OPTIONS are optional and any missing values fallback to running transparently.

OPTIONS:

  • logging - logging level (debug | info | warn | error) (default: info) [$LOGGING]
  • wrapper-config - optional wrapper api config yaml (resolved from secret manager by the pipeline) [$WRAPPER_CONFIG]
  • step - optional step name for the current pipeline execution [$INFRALIB_STEP]
  • prefix-step - optional step name with cloud prefix [$TF_VAR_prefix]
  • command - optional infralib command to execute (plan | apply | plan-destroy | apply-destroy | argocd-plan | argocd-apply | argocd-plan-destroy | argocd-apply-destroy) [$COMMAND]
  • entrypoint - optional path to the infralib-tool entrypoint script (default: entrypoint-core.sh) [$INFRALIB_ENTRYPOINT]
  • campaign-id - optional agent-run identifier forwarded to the backend handshake; empty runs the wrapper transparently [$CAMPAIGN_ID]
  • pipeline-index - optional release iteration index forwarded to the backend handshake [$PIPELINE_INDEX]
  • insecure - optional allow insecure gRPC connection (default: false) [$INSECURE]

Custom Parameters​

Agent has helpful commands for managing custom parameters that can be used in the config file with the {{ .output-custom.key }} replacement tag. These commands are:

  • add-custom - for adding or updating a custom parameter
  • delete-custom - for deleting a custom parameter
  • get-custom - for getting a custom parameter value
  • list-custom - for listing all custom parameters created by the agent

Optionally, prefix will be used to pull the config and config is used to check for an encryption module. If present, the created key will be encrypted with customer encryption. More info in Encryption.

OPTIONS:

  • logging - logging level (debug | info | warn | error) (default: info) [$LOGGING]
  • config - config file path and name, only needed when overriding an existing config [$CONFIG]
  • prefix - prefix used when creating cloud resources [$PREFIX]
  • project-id - project id used when creating gcloud resources [$PROJECT_ID]
  • location - location used when creating gcloud resources [$LOCATION]
  • zone - zone used in gcloud run jobs [$ZONE]
  • google-application-credentials-json - optional, gcloud service account credentials JSON string [$GOOGLE_APPLICATION_CREDENTIALS_JSON]
  • oci-region - oracle cloud region used when creating oracle resources [$OCI_REGION]
  • oci-compartment-id - oracle cloud compartment ocid where resources are created, selects the oracle provider when set [$OCI_COMPARTMENT_ID]
  • oci-profile - oracle cloud config file profile used for credentials, empty uses the default profile [$OCI_PROFILE]
  • oci-config-file - path to the oracle cloud config file used for credentials, empty uses ~/.oci/config [$OCI_CONFIG_FILE]
  • azure-subscription-id - azure subscription id where resources are created, selects the azure provider when set [$AZURE_SUBSCRIPTION_ID]
  • azure-location - azure location used when creating resources, required with azure-subscription-id [$AZURE_LOCATION]
  • azure-resource-group - existing azure resource group for the agent resources, defaults to <prefix>-<location> which the agent creates and deletes when empty; a provided group must not be shared by the same prefix in another location [$AZURE_RESOURCE_GROUP]
  • key - key for the custom parameter [$KEY]
  • value - value for the custom parameter [$VALUE]
  • overwrite - overwrite existing custom parameter value, default false [$OVERWRITE]

Example

bin/ei-agent add-custom --key=custom-key --value=custom-value

Version​

Prints the agent version, build date and commit hash.

Example

bin/ei-agent version